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rhe  National  Institute  of  Standards  and  Technology"  was  established  by  an  act  of  Congress  on  March  3, 
1901.  The  Institute's  overall  goal  is  to  strengthen  and  advance  the  Nation's  science  and  technology  and 
facilitate  their  effective  application  for  public  benefit.  To  this  end,  the  Institute  conducts  research  to  assure  interna- 
tional competitiveness  and  leadership  of  U.S.  industry,  science  and  technology.  NIST  work  involves  development 
and  transfer  of  measurements,  standards  and  related  science  and  technology,  in  support  of  continually  improving 
U.S.  productivity,  product  quality  and  reliability,  innovation  and  underlying  science  and  engineering.  The  Institute's 
technical  work  is  performed  by  the  National  Measurement  Laboratory,  the  National  Engineering  Laboratory,  the 
National  Computer  Systems  Laboratory,  and  the  Institute  for  Materials  Science  and  Engineering. 

The  National  Measurement  Laboratory 


Provides  the  national  system  of  physical  and  chemical  measurement; 
coordinates  the  system  with  measurement  systems  of  other  nations 
and  furnishes  essential  services  leading  to  accurate  and  uniform 
physical  and  chemical  measurement  throughout  the  Nation's  scientific 
community,  industry,  and  commerce;  provides  advisory  and  research 
services  to  other  Government  agencies;  conducts  physical  and  chemical 
research;  develops,  produces,  and  distributes  Standard  Reference 
Materials;  provides  calibration  services;  and  manages  the  National 
Standard  Reference  Data  System.  The  Laboratory  consists  of  the 
following  centers: 

The  National  Engineering  Laboratory 


Basic  Standards^ 
Radiation  Research 
Chemical  Physics 
Analytical  Chemistry 


Provides  technology  and  technical  services  to  the  piiblic  and  private 
sectors  to  address  national  needs  and  to  solve  national  problems; 
conducts  research  in  engineering  and  applied  science  in  support  of  these 
efforts;  builds  and  maintains  competence  in  the  necessary  disciplines 
required  to  carry  out  this  research  and  technical  service;  develops  engi- 
neering data  and  measurement  capabilities;  provides  engineering  measure- 
ment traceability  services;  develops  test  methods  and  proposes  engi- 
neering standards  and  code  changes;  develops  and  proposes  new 
engineering  practices;  and  develops  and  improves  mechanisms  to 
transfer  results  of  its  research  to  the  ultimate  user.  The  Laboratory 
consists  of  the  following  centers: 

The  National  Computer  Systems  Laboratory 


Computing  and  Applied 
Mathematics 

Electronics  and  Electrical 
Engineering^ 

Manufacturing  Engineering 
Building  Technology 
Fire  Research 
Chemical  Engineering'' 


Conducts  research  and  provides  scientific  and  technical  services  to  aid 
Federal  agencies  in  the  selection,  acquisition,  application,  and  use  of 
computer  technology  to  improve  effectiveness  and  economy  in  Govern- 
ment operations  in  accordance  with  Public  Law  89-306  (40  U.S.C.  759), 
relevant  Executive  Orders,  and  other  directives;  carries  out  this  mission 
by  managing  the  Federal  Information  Processing  Standards  Program, 
developing  Federal  ADP  standards  guidelines,  and  managing  Federal 
participation  in  ADP  voluntary  standardization  activities;  provides  scien- 
tific and  technological  advisory  services  and  assistance  to  Federal 
agencies;  and  provides  the  technical  foundation  for  computer-related 
policies  of  the  Federal  Government  The  Laboratory  consists  of  the 
following  divisions: 

The  Institute  for  Materials  Science  and  Engineering 


Information  Systems 
Engineering 
Systems  and  Software 
Technology 
Computer  Security 
Systems  and  Network 
Architecture 
Advanced  Systems 


Conducts  research  and  provides  measurements,  data,  standards,  refer- 
ence materials,  quantitative  imderstanding  and  other  technical  informa- 
tion fundamental  to  the  processing,  structure,  properties  and  perfor- 
mance of  materials;  addresses  the  scientific  basis  for  new  advanced 
materials  technologies;  plans  research  arouiKi  cross-cutting  scientific 
themes  such  as  oondestructive  evaluation  and  phase  diagram  develop- 
ment; oversees  Institute-wide  technical  programs  in  nuclear  reactor 
radiation  research  and  nondestructive  evaluation;  and  broadly  dissem- 
inates generic  technical  information  resulting  from  its  programs.  The 
Institute  consists  of  the  following  divisions; 


Ceramics 

Fracture  and  Deformation^ 

Polymers 

Metallurgy 

Reactor  Radiation 


'Headquarten  and  Laboratories  at  Gaithersburg,  MD,  unless  otlierwise  noted;  mailing  address 
Gaitbenburg.  MD  20899. 

%ome  divisions  within  the  center  are  located  at  Boulder,  CO  80303. 
'  Located  at  Boulder,  CO,  with  tome  elements  at  Gaithersburg.  MD. 
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Reports  on  Computer  Systems  Technology 

The  National  Institute  of  Standards  and  Technology  (NIST)  (formerly  the  National  Bureau  of  Standards) 
has  a  unique  responsibility  for  computer  systems  technology  within  the  Federal  government.  NIST's 
National  Computer  Systems  Laboratory  (NCSL)  develops  standards  and  guidelines,  provides  technical 
assistance,  and  conducts  research  for  computers  and  related  telecommunications  systems  to  achieve 
more  effective  utilization  of  Federal  information  technology  resources,  NCSL's  responsibilities  include 
development  of  technical,  management,  physical,  and  administrative  standards  and  guidelines  for  the 
cost-effective  security  and  privacy  of  sensitive  unclassified  information  processed  in  Federal  computers. 
NCSL  assists  agencies  in  developing  security  plans  and  in  improving  computer  security  awareness  train- 
ing. This  Special  Publication  500  series  reports  NCSL  research  and  guidelines  to  Federal  agencies  as  well 
as  to  organizations  In  industry,  government,  and  academia. 
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The  National  Institute  of  Standards  and  Technology  (NIST)  is 
responsible  for  developing  standards,  providing  technical  assistance, 
and  conducting  research  for  computers  and  related  systems.  These 
activities  provide  technical  support  to  government  and  industry  in  the 
effective,  safe,  and  economical  use  of  computers.  With  the  passage  of 
the  Computer  Security  Act  of  1987  (P.L.  100-235),  NIST's  activities 
also  include  the  development  of  standards  and  guidelines  needed  to 
assure  the  cost-effective  security  and  privacy  of  sensitive  information 
in  Federal  computer  systems.  This  guide  is  just  one  of  three 
brochures  designed  for  a  specific  audience.  The  "Executive  Guide  to 
the  Protection  of  Information  Resources,"  and  the  "Managers  Guide 
to  the  Protection  of  Information  Resources"  complete  the  series. 
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Introduction 


Today's  computer  technology,  with  microcomputers  and  on-hne  ac- 
cess, has  placed  the  power  of  the  computer  where  it  belongs,  in 
YOUR  hands.  YOU,  the  users,  develop  computer  appUcations  and 
perform  other  data  processing  functions  which  previously  were  only 
done  by  the  computer  operations  personnel.  These  advances  have 
greatly  improved  our  efficiency  and  effectiveness  but,  also  present  a 
serious  challenge  in  achieving  adequate  data  security. 

While  excellent  progress  has  been  made  in  computer  technology, 
very  Uttle  has  been  done  to  inform  users  of  the  vulnerability  of  data 
and  information  to  such  threats  as  unauthorized  modification,  dis- 
closure, and  destruction,  either  deliberate  or  accidental.  This  guide 
will  make  you  aw2ire  of  some  of  the  undesirable  things  that  can  hap- 
pen to  data  and  will  provide  some  practical  solutions  for  reducing 
your  risks  to  these  threats. 

WHO  IS  RESPONSIBLE  FOR  PROTECTING  DATA  AND  INFOR- 
MATION? 

The  statement  that  "security  is  everyone's  responsibility"  is  absolutely 
true.  Owners,  developers,  operators  and  users  of  information  systems 
each  has  a  personal  responsibihty  to  protect  these  resources.  Func- 
tional managers  have  thq  responsibihty  to  provide  appropriate 
security  controls  for  any  information  resources  entrusted  to  them. 
These  managers  are  personally  responsible  for  understanding  the 
sensitivity  and  criticahty  of  their  data  and  the  extent  of  losses  that 
could  occur  if  the  resources  are  not  protected.  Managers  must  en- 
sure that  all  users  of  their  data  and  systems  are  made  aware  of  the 
practices  and  procedures  used  to  protect  the  information  resources. 
When  you  don't  know  what  your  security  responsibihties  are,  ASK 
YOUR  MANAGER  OR  SUPERVISOR. 

WHAT  IS  "SENSITIVE"  DATA? 

All  data  is  sensitive  to  some  degree;  exactly  how  sensitive  is  unique  to 
each  business  environment.  Within  the  Federal  Government,  per- 
sonal information  is  sensitive  to  unauthorized  disclosure  under  the 
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Privacy  Act  of  1974.  In  some  cases,  data  is  far  more  sensitive  to  ac- 
cidental errors  or  omissions  that  compromise  accuracy,  integrity,  or 
availability.  For  example,  in  a  Management  Information  System,  in- 
accurate, incomplete,  or  obsolete  information  can  result  in  erroneous 
management  decisions  which  could  cause  serious  damage  and  re- 
quire time  and  money  to  rectify.  Data  and  information  which  art  criti- 
cal to  an  agency's  ability  to  perform  its  mission  are  sensitive  to  non- 
avadlability. 

Still  other  data  are  sensitive  to  fraudulent  mamipulation  for  personal 
gain.  Systems  that  process  electronic  funds  transfers,  control  inven- 
tories, issue  checks,  control  accounts  receivables  and  payables,  etc., 
cam  be  fraudulently  exploited  resulting  in  serious  losses  to  an  agency. 

One  way  to  determine  the  sensitivity  of  data  is  to  ask  the  questions 
"What  will  it  cost  if  the  data  is  wrong?  Manipulated  for  fraudulent 
purposes?  Not  available?  Given  to  the  wrong  person?"  If  the  damiage 
is  more  than  you  can  tolerate,  then  the  data  is  sensitive  and  should 
have  adequate  security  controls  to  prevent  or  lessen  the  potential  loss. 

WHAT  RISKS  ARE  ASSOCIATED  WITH  THE  USE  OF  COM- 
PUTERS? 

Over  the  past  several  decades,  computers  have  taken  over  virtually 
all  of  our  major  record-keeping  functions.  Recently,  personal  com- 
puters have  made  it  cost-effective  to  automate  many  office  functions. 
Computerization  has  many  advantages  and  is  here  to  stay;  however, 
automated  systems  introduce  new  risks,  and  we  should  take  steps  to 
control  those  risks. 

We  should  be  concerned  with  the  same  risks  that  existed  when 
manual  procedures  were  used,  as  well  as  some  new  risks  created  by 
the  unique  nature  of  computers  themselves.  One  risk  introduced  by 
computers  is  the  concentration  of  tremendous  amounts  of  data  in 
one  location.  The  greater  the  concentration,  the  greater  the  conse- 
quences of  loss  or  damage.  Another  example  is  that  computer  users 
access  information  from  remote  terminads.  We  must  be  able  to  posi- 
tively identify  the  user,  as  well  as  ensure  that  the  user  is  only  able  to 
access  information  and  functions  that  have  been  authorized. 
Newspaper  accounts  of  computer  "hackers,"  computer  virus  attacks. 
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and  other  types  of  intruders  underscore  the  reahty  of  the  threat  to 
government  and  commercial  computer  systems. 

HOW  MUCH  SECURITY  IS  ENOUGH? 

No  matter  how  many  controls  or  safeguards  we  use,  we  can  never 
achieve  total  security.  We  can,  however,  decrease  the  risk  in  propor- 
tion to  the  strength  of  the  protective  measures.  The  degree  of  protec- 
tion is  based  on  the  value  of  the  information;  in  other  words,  how 
serious  would  be  the  consequences  if  a  certain  type  of  information 
were  to  be  wrongfully  changed,  disclosed,  delayed,  or  destroyed? 
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General  Responsibilities 


All  Federal  computer  system  users  share  certain  general  respon- 
sibilities for  information  resource  protection.  The  following  con- 
siderations should  guide  your  actions. 

•  Treat  information  as  you  would  any  valuable  asset. 

You  would  not  walk  away  from  your  desk  leaving  cash  or  other  vadu- 
ables  unattended.  You  should  tcike  the  same  C2ire  to  protect  informa- 
tion. If  you  are  not  sure  of  the  value  or  sensitivity  of  the  various  kinds 
of  information  you  handle,  ask  your  manager  for  guideuice. 

•  Use  government  computer  systems  only  for  lawful " 
and  authorized  purposes. 

The  computer  systems  you  use  in  your  daily  work  should  be  used  only 
for  authorized  purposes  and  in  a  lawful  manner.  There  are  computer 
crime  laws  that  prescribe  criminal  penalties  for  those  who  illegally  ac- 
cess Federal  computer  systems  or  data.  Additionally,  the  un- 
authorized use  of  Federal  computer  systems  or  use  of  authorized 
privileges  for  unauthorized  purposes  could  result  in  disciplinary  ac- 
tion. 

•  Observe  policies  and  procedures  established  by 
agency  management. 

Specific  requirements  for  the  protection  of  information  have  been  es- 
tablished by  your  agency.  These  requirements  may  be  found  in  pohcy 
manuals,  rules,  or  procedures.  Ask  your  manager  if  you  are  unsure 
about  your  own  responsibihties  for  protection  of  information. 

•  Recognize  that  you  are  accountable  for  your  ac- 
tivities on  computer  systems. 

After  you  receive  authorization  to  use  any  Federal  computer  system, 
you  become  personally  responsible  and  accountable  for  your  activity 
on  the  system.  Accordingly,  your  use  should  be  restricted  to  those 
functions  needed  to  carry  out  job  responsibilities. 
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•  Report  unusual  occurrences  to  your  manager. 

Many  losses  would  be  avoided  if  computer  users  would  report  any 
circumstances  that  seem  unusual  or  irregul2ir.  Warning  signals  could 
include  such  things  as  unexplainable  system  activity  that  you  did  not 
perform,  data  that  appears  to  be  of  questionable  accuracy,  and  imex- 
pected  or  incorrect  processing  results.  If  you  should  notice  anything 
of  a  questionable  nature,  bring  it  to  your  manager's  attention. 
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Security  and  Control  Guidelines 


Some  common-sense  protective  measures  can  reduce  the  risk  of  loss, 
damage,  or  disclosure  of  information.  Following  are  the  most  impor- 
t£mt  areas  of  information  systems  controls  that  assure  that  the  system 
is  properly  used,  resistant  to  disruptions,  cmd  rehable. 

•  Make  certain  no  one  can  impersonate  you. 

If  a  password  is  used  to  verify  your  identity,  this  is  the  key  to  system 
security.  Do  not  disclose  your  password  to  anyone,  or  allow  anyone 
to  observe  your  password  as  you  enter  it  during  the  sign-on  process. 
If  you  choose  your  own  password,  avoid  selecting  a  password  with 
any  personal  associations,  or  one  that  is  very  simple  or  short.  The  aim 
is  to  select  a  password  that  would  be  difficult  to  guess  or  derive. 
"IREDDOG"  would  be  a  better  password  than  "DUKE." 

If  your  system  allows  you  to  change  your  own  password,  do  so 
regularly.  Find  out  what  your  agency  requires,  and  change  passwords 
at  least  that  frequently.  Periodic  password  changes  keep  undetected 
intruders  from  continuously  using  the  password  of  a  legitimate  user. 

After  you  are  logged  on,  the  computer  will  attribute  all  activity  to 
your  user  id.  Therefore,  never  leave  your  terminal  without  logging  off 
—  even  for  a  few  minutes.  Always  log  off  or  otherwise  inactivate  your 
terminal  so  no  one  could  perform  my  activity  under  your  user  id 
when  you  are  away  from  the  area. 

•  Safeguard  sensitive  information  from  disclosure  to 
otfiers. 

People  often  forget  to  lock  up  sensitive  reports  and  computer  media 
containing  sensitive  data  when  they  leave  their  work  areas.  Informa- 
tion carelessly  left  on  top  of  desks  and  in  unlocked  storage  can  be 
casually  observed,  or  deliberately  stolen.  Every  employee  who  works 
with  sensitive  information  should  have  lockable  space  available  for 
storage  when  information  is  not  in  use.  If  you  aren't  sure  what  infor- 
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mation  should  be  locked  up  or  what  locked  storage  is  available,  ask 
your  manager. 

While  working,  be  aware  of  the  visibility  of  data  on  your  personal 
computer  or  terminal  display  screen.  You  may  need  to  reposition 
equipment  or  furniture  to  eliminate  over-the-shoulder  viewing.  Be 
especially  careful  near  windows  and  in  public  areas.  Label  all  sensi- 
tive diskettes  and  other  computer  media  to  alert  other  employees  of 
the  need  to  be  especially  careful.  When  no  longer  needed,  sensitive 
information  should  be  deleted  or  discarded  in  such  a  way  that  un- 
authorized individuals  cannot  recover  the  data.  Printed  reports 
should  be  finely  shredded,  while  data  on  magnetic  media  should  be 
overwritten.  Files  that  are  merely  deleted  are  not  really  erased  and 
Ccui  still  be  recovered. 

•  Install  physical  security  devices  or  software  on  per- 
sonal computers. 

The  value  and  populau^ity  of  person2il  computers  make  theft  a  big 
problem,  especially  in  low-security  office  areas.  Relatively  inexpen- 
sive hardware  devices  greatly  reduce  the  risk  of  equipment  loss.  Such 
devices  involve  lock-down  cables  or  enclosures  that  attach  equip- 
ment to  furniture.  Another  approach  is  to  place  equipment  in  lock- 
able  cabinets. 

When  data  is  stored  on  a  hard  disk,  take  some  steps  to  keep  un- 
authorized individuals  from  accessing  that  data.  A  power  lock  device 
only  allows  key-holders  to  turn  on  power  to  the  personal  computer. 
Where  there  is  a  need  to  segregate  information  between  multiple 
authorized  users  of  a  personad  computer,  additional  security  in  the 
form  of  software  is  probably  needed.  Specific  files  could  be 
encrypted  to  make  them  unintelligible  to  unauthorized  staff,  or  ac- 
cess control  software  can  divide  storage  space  among  authorized 
users,  restricting  each  user  to  their  own  files. 

•  Avoid  costly  disruptions  caused  by  data  or 
hardware  loss. 

Disruptions  and  delays  are  expensive.  No  one  enjoys  working  franti- 
cally to  re-enter  work,  do  the  same  job  twice,  or  fix  problems  while 
new  work  piles  up.  Most  disruptions  can  be  prevented,  and  the  im- 
pact of  disruptions  can  be  minimized  by  advance  planning.  Proper  en- 
vironmental conditions  and  power  suppUes  minimize  equipment  out- 
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ages  and  information  loss.  Many  electrical  circuits  in  office  2ireas  do 
not  constitute  an  adequate  power  source,  so  dedicated  circuits  for 
computer  systems  should  be  considered.  Make  certEiin  that  your  sur- 
roundings meet  the  essential  requirements  for  correct  equipment 
operation.  Cover  equipment  when  not  in  use  to  protect  it  from  dust, 
water  leaks,  and  other  hazards. 

For  protection  from  accidental  or  deliberate  destruction  of  data, 
regular  data  backups  are  essential.  Complete  system  backups  should 
be  taken  at  intervals  determined  by  how  quickly  information  changes 
or  by  the  volume  of  transactions.  Backups  should  be  stored  in 
2Uiother  location,  to  guard  against  the  possibihty  of  original  and  back- 
up copies  being  destroyed  by  the  same  fire  or  other  disaster. 

•  Maintain  tiie  auttiohzed  liardware  I  software  con- 
figuration. 

Some  organizations  have  been  affected  by  computer  "viruses"  ac- 
quired through  seemingly  useful  or  innocent  software  obtained  from 
pubUc  access  bulletin  boards  or  other  sources;  others  have  been  U- 
able  for  software  illegally  copied  by  employees.  The  instcillation  of  un- 
authorized hardw2ire  can  cause  damage,  inv2didate  wairranties,  or 
have  other  negative  consequences.  Install  only  hardware  or  software 
that  has  been  acquired  through  normal  acquisition  procedures  and 
comply  with  all  software  Ucensing  agreement  requirements. 
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SUMMARY 


Ultimately,  computer  security  is  the  user's  responsibility.  You,  the 
user,  must  be  alert  to  possible  breaches  in  security  and  adhere  to  the 
security  regulations  that  have  been  estabUshed  within  your  agency. 
The  security  practices  listed  are  not  inclusive,  but  rather  designed  to 
remind  you  and  raise  your  awareness  towards  securing  your  informa- 
tion resources: 

PROTECT  YOUR  EQUIPMENT 

•  Keep  it  in  a  secure  environment 

•  Keep  food,  drink,  and  cigarettes  AWAY  from  it 

•  Know  where  the  fire  suppression  equipment  is  lo- 
cated and  know  now  to  use  it 

PROTECT  YOUR  AREA 

•  Keep  unauthorized  people  AWAY  from  your  equip- 
ment and  data 

•  Challenge  strangers  in  your  area 
PROTECT  YOUR  PASSWORD 

•  Never  write  it  down  or  give  it  to  anyone 

•  Don 't  use  names,  numbers  or  dates  which  are  per- 
sonally identified  with  you 

•  Change  it  often,  but  change  it  immediately  if  you 
think  It  has  been  compromised 

PROTECT  YOUR  FILES 

•  Don  Y  allow  unauthorized  access  to  your  files  and 
data 

•  NEVER  leave  your  equipment  unattended  with 
your  password  activated-  SIGN  OFF! 

PROTECT  AGAINST  VIRUSES 

•  Don  Y  use  unauthorized  software 

•  Back  up  your  files  before  implementing  ANY  new 
software 
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LOCK  UP  STORAGE  MEDIA  CONTAINING  SENSITIVE  DATA 

•  If  the  data  or  information  is  sensitive  or  critical  to 
your  operation,  lock  it  up! 

BACK  UP  YOUR  DATA 

•  Keep  duplicates  of  your  sensitive  data  in  a  safe 
place,  out  of  your  immediate  area 

•  Back  it  up  as  often  as  necessary 

REPORT  SECURITY  VIOLATIONS 

•  Tell  your  manager  if  you  see  any  unauthorized 
changes  to  your  data 

•  Immediately  report  any  loss  of  data  or  programs, 
whether  automated  or  hard  copy 
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For  Additional  Information 


National  Institute  of  Standards  and  Technology 

Computer  Security  Program  Office 
A-216  Technology 
Gaithersburg,  MD  20899 
(301)  975-5200 


For  further  information  on  the  management  of  information  resour- 
ces, NIST  publishes  Federal  Information  Processing  Standards 
Pubhcations  (FIBS  PUBS).  These  pubhcations  deal  with  many 
aspects  of  computer  security,  including  password  usage,  data  encryp- 
tion, ADP  risk  management  and  contingency  planning,  and  computer 
system  security  certification  and  accreditation.  A  hst  of  current  pub- 
hcations is  available  from: 


Standards  Processing  Coordinator  (ADP) 
National  Computer  Systems  Laboratory 
National  Institute  of  Standards  and  Technology 
Technology  Building,  B-64 
Gaithersburg,  MD  20899 
Phone:  (301)  975-2817 
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